Resubmissions

20-03-2021 12:36

210320-3ndwxm4phj 10

General

  • Target

    866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc

  • Size

    12.2MB

  • Sample

    210320-3ndwxm4phj

  • MD5

    a5f6b6e95ef8a26081259813ca18e17b

  • SHA1

    242bc043057bb12e27a9fe4db20d6bdb953cbc11

  • SHA256

    866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc

  • SHA512

    479f7f546102a45183a8ff5c3790518539d2a1baf1e9ab257612e59154061f7aa2204b17d28d233b7ca8899e200d3d227855b6f5fcca48afcc962c47f754211f

Malware Config

Extracted

Path

C:\decrypt_file.TxT

Ransom Note
*************************** | We Are Back ? *************************** We hacked your (( Network )), and now all files, documents, images, databases and other important data are safely encrypted using the strongest algorithms ever. You cannot access any of your files or services . But do not worry. You can restore everthing and get back business very soon ( depends on your actions ) before I tell how you can restore your data, you have to know certain things : We have downloaded most of your data ( especially important data ) , and if you don't contact us within 2 days, your data will be released to the public. To see what happens to those who didn't contact us, just google : ( Blackkingdom Ransomware ) *************************** | What guarantees ? *************************** We understand your stress and anxiety. So you have a free opportunity to test our service by instantly decrypting one or two files for free just send the files you want to decrypt to (support_blackkingdom2@protonmail.com *************************************************** | How to contact us and recover all of your files ? *************************************************** The only way to recover your files and protect from data leaks, is to purchase a unique private key for you that we only posses . [ + ] Instructions: 1- Send the decrypt_file.txt file to the following email ===> support_blackkingdom2@protonmail.com 2- send the following amount of US dollars ( 10,000 ) worth of bitcoin to this address : [ 1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT ] 3- confirm your payment by sending the transfer url to our email address 4- After you submit the payment, the data will be removed from our servers, and the decoder will be given to you, so that you can recover all your files. ## Note ## Dear system administrators, do not think you can handle it on your own. Notify your supervisors as soon as possible. By hiding the truth and not communicating with us, what happened will be published on social media and yet in news websites. Your ID ==> gAhmHQIZrniAIQvWcGBn
Emails

support_blackkingdom2@protonmail.com

Wallets

1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT

Extracted

Path

C:\decrypt_file.TxT

Ransom Note
*************************** | We Are Back ? *************************** We hacked your (( Network )), and now all files, documents, images, databases and other important data are safely encrypted using the strongest algorithms ever. You cannot access any of your files or services . But do not worry. You can restore everthing and get back business very soon ( depends on your actions ) before I tell how you can restore your data, you have to know certain things : We have downloaded most of your data ( especially important data ) , and if you don't contact us within 2 days, your data will be released to the public. To see what happens to those who didn't contact us, just google : ( Blackkingdom Ransomware ) *************************** | What guarantees ? *************************** We understand your stress and anxiety. So you have a free opportunity to test our service by instantly decrypting one or two files for free just send the files you want to decrypt to (support_blackkingdom2@protonmail.com *************************************************** | How to contact us and recover all of your files ? *************************************************** The only way to recover your files and protect from data leaks, is to purchase a unique private key for you that we only posses . [ + ] Instructions: 1- Send the decrypt_file.txt file to the following email ===> support_blackkingdom2@protonmail.com 2- send the following amount of US dollars ( 10,000 ) worth of bitcoin to this address : [ 1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT ] 3- confirm your payment by sending the transfer url to our email address 4- After you submit the payment, the data will be removed from our servers, and the decoder will be given to you, so that you can recover all your files. ## Note ## Dear system administrators, do not think you can handle it on your own. Notify your supervisors as soon as possible. By hiding the truth and not communicating with us, what happened will be published on social media and yet in news websites. Your ID ==> hUijnL7wBtieGgxJQJAL
Emails

support_blackkingdom2@protonmail.com

Wallets

1Lf8ZzcEhhRiXpk6YNQFpCJcUisiXb34FT

Targets

    • Target

      866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc

    • Size

      12.2MB

    • MD5

      a5f6b6e95ef8a26081259813ca18e17b

    • SHA1

      242bc043057bb12e27a9fe4db20d6bdb953cbc11

    • SHA256

      866b1f5c5edd9f01c5ba84d02e94ae7c1f9b2196af380eed1917e8fc21acbbdc

    • SHA512

      479f7f546102a45183a8ff5c3790518539d2a1baf1e9ab257612e59154061f7aa2204b17d28d233b7ca8899e200d3d227855b6f5fcca48afcc962c47f754211f

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops desktop.ini file(s)

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Tasks